Spawn plan: what a child forge is made of, as one validated value (apps, crew briefs, subscriptions; never secrets) #420

Part of #389.

Intent: a pure module src/spawn/plan.ts, plain data in, plain data out, no side effects: planSpawn(input) returns a SpawnPlan or the first refusal.

Input: child and org name, the chosen apps (repos the viewer can read), whether to carry crew briefs, whether to carry subscriptions.

Copied: each chosen app as a repository with full history and its forge.json; crew briefs (text, not run history); subscriptions as names only. Never copied: the parent's secrets, tokens, SSH keys, agent credentials, run ledger, issues, user accounts.

Acceptance:

• [ ] names, list sizes and app references validated at the boundary; an unknown or unreadable app is refused with the reason
• [ ] a dry-run view (what is copied, what is left behind, bytes) the studio can show before anything happens
• [ ] tests: a forge full of secrets yields a plan containing none of them; plan is deterministic